create-fullstack-scaffold 0.1.0

package/template/src/server/module-order/routes/order-routes.ts

@@ -0,0 +1,202 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import * as orderService from '../services/order-service'
+import { successResponse, errorResponse, success, created } from '@server/utils/route-helpers'
+import { NotFoundError } from '@server/utils/app-error'
+import { authMiddleware } from '@server/middleware/auth'
+import { Permission } from '@shared/modules/permission'
+import {
+  OrderSchema,
+  CreateOrderSchema,
+  UpdateOrderSchema,
+  OrderListSchema,
+  DeleteResultSchema,
+  OrderQuerySchema,
+} from '@shared/modules/order'
+
+const listRoute = createRoute({
+  method: 'get',
+  path: '/orders',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_VIEW] })],
+  request: {
+    query: OrderQuerySchema,
+  },
+  responses: {
+    200: successResponse(OrderListSchema, 'List all orders'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const getRoute = createRoute({
+  method: 'get',
+  path: '/orders/{id}',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_VIEW] })],
+  request: {
+    params: OrderSchema.pick({ id: true }),
+  },
+  responses: {
+    200: successResponse(OrderSchema, 'Get order by id'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Order not found'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const createRouteDef = createRoute({
+  method: 'post',
+  path: '/orders',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_CREATE] })],
+  request: {
+    body: {
+      content: {
+        'application/json': {
+          schema: CreateOrderSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    201: successResponse(OrderSchema, 'Create order'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    400: errorResponse('Invalid input'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const updateRoute = createRoute({
+  method: 'put',
+  path: '/orders/{id}',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_EDIT] })],
+  request: {
+    params: OrderSchema.pick({ id: true }),
+    body: {
+      content: {
+        'application/json': {
+          schema: UpdateOrderSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    200: successResponse(OrderSchema, 'Update order'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Order not found'),
+    400: errorResponse('Invalid input'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const deleteRoute = createRoute({
+  method: 'delete',
+  path: '/orders/{id}',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_DELETE] })],
+  request: {
+    params: OrderSchema.pick({ id: true }),
+  },
+  responses: {
+    200: successResponse(DeleteResultSchema, 'Order deleted'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Order not found'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const processRoute = createRoute({
+  method: 'put',
+  path: '/orders/{id}/process',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_PROCESS] })],
+  request: {
+    params: OrderSchema.pick({ id: true }),
+  },
+  responses: {
+    200: successResponse(OrderSchema, 'Order processed'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Order not found'),
+    400: errorResponse('Cannot process order'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+const cancelRoute = createRoute({
+  method: 'put',
+  path: '/orders/{id}/cancel',
+  tags: ['orders'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredPermissions: [Permission.ORDER_PROCESS] })],
+  request: {
+    params: OrderSchema.pick({ id: true }),
+  },
+  responses: {
+    200: successResponse(OrderSchema, 'Order cancelled'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Order not found'),
+    400: errorResponse('Cannot cancel order'),
+    500: errorResponse('Internal server error'),
+  },
+})
+
+export const orderRoutes = new OpenAPIHono()
+  .openapi(listRoute, async c => {
+    const { status, customerName, limit, offset } = c.req.valid('query')
+    const result = await orderService.getOrders({
+      status: status ?? undefined,
+      customerName: customerName ?? undefined,
+    })
+    return c.json(success(result.slice(offset, offset + limit)), 200)
+  })
+  .openapi(getRoute, async c => {
+    const { id } = c.req.valid('param')
+    const result = await orderService.getOrderById(id)
+    if (!result) throw new NotFoundError('Order', id)
+    return c.json(success(result), 200)
+  })
+  .openapi(createRouteDef, async c => {
+    const body = c.req.valid('json')
+    const result = await orderService.createOrder(body)
+    return c.json(created(result), 201)
+  })
+  .openapi(updateRoute, async c => {
+    const { id } = c.req.valid('param')
+    const body = c.req.valid('json')
+    const result = await orderService.updateOrder(id, body)
+    if (!result) throw new NotFoundError('Order', id)
+    return c.json(success(result), 200)
+  })
+  .openapi(deleteRoute, async c => {
+    const { id } = c.req.valid('param')
+    const result = await orderService.deleteOrder(id)
+    if (result.message === '订单不存在') throw new NotFoundError('Order', id)
+    return c.json(success({ message: 'Deleted successfully' }), 200)
+  })
+  .openapi(processRoute, async c => {
+    const { id } = c.req.valid('param')
+    const result = await orderService.processOrder(id)
+    if (!result) throw new NotFoundError('Order', id)
+    return c.json(success(result), 200)
+  })
+  .openapi(cancelRoute, async c => {
+    const { id } = c.req.valid('param')
+    const result = await orderService.cancelOrder(id)
+    if (!result) throw new NotFoundError('Order', id)
+    return c.json(success(result), 200)
+  })

package/template/src/server/module-order/services/order-service.ts

@@ -0,0 +1,268 @@
+import { eq, desc, and, like, or } from 'drizzle-orm'
+import type { Order, CreateOrderInput, UpdateOrderInput, OrderStatus } from '@shared/modules/order'
+import { getDb } from '@server/db'
+import { orders, type OrderTable } from '@server/db/schema'
+import { toISOString } from '@server/utils/date'
+import { generateOrderNo, randomDate, randomElement } from '@server/utils/generate'
+import { parseModuleId } from '@server/utils/id-helpers'
+
+export async function seedOrdersIfEmpty(): Promise<void> {
+  const db = await getDb()
+  const existing = await db.select().from(orders).all()
+  if (existing.length === 0) {
+    const STATUSES: OrderStatus[] = ['pending', 'processing', 'completed', 'cancelled', 'disputed']
+    const CUSTOMERS = [
+      { name: '张三', email: 'zhangsan@example.com' },
+      { name: '李四', email: 'lisi@example.com' },
+      { name: '王五', email: 'wangwu@example.com' },
+      { name: '赵六', email: 'zhaoliu@example.com' },
+      { name: '钱七', email: 'qianqi@example.com' },
+    ]
+    const PRODUCTS = [
+      '高级会员订阅',
+      '专业版软件授权',
+      '企业级解决方案',
+      '数据分析服务',
+      '技术支持套餐',
+      '定制开发服务',
+    ]
+
+    for (let i = 0; i < 25; i++) {
+      const customer = randomElement(CUSTOMERS)
+      const product = randomElement(PRODUCTS)
+      const status = randomElement(STATUSES)
+      const createdAt = new Date(randomDate(new Date('2024-01-01'), new Date()))
+
+      await db.insert(orders).values({
+        orderNo: generateOrderNo(),
+        customerName: customer.name,
+        customerEmail: customer.email,
+        productName: product,
+        amount: Math.floor(Math.random() * 10000) + 100,
+        status,
+        createdAt,
+        updatedAt: new Date(randomDate(createdAt, new Date())),
+      })
+    }
+  }
+}
+
+export async function getOrders(filters?: {
+  status?: OrderStatus
+  customerName?: string
+}): Promise<Order[]> {
+  const db = await getDb()
+  const conditions = []
+
+  if (filters?.status) {
+    conditions.push(eq(orders.status, filters.status))
+  }
+  if (filters?.customerName) {
+    conditions.push(
+      or(
+        like(orders.customerName, `%${filters.customerName}%`),
+        like(orders.customerEmail, `%${filters.customerName}%`)
+      )!
+    )
+  }
+
+  const rows =
+    conditions.length > 0
+      ? await db
+          .select()
+          .from(orders)
+          .where(and(...conditions))
+          .orderBy(desc(orders.createdAt))
+      : await db.select().from(orders).orderBy(desc(orders.createdAt))
+
+  return rows.map((row: OrderTable) => ({
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }))
+}
+
+export async function getOrderById(id: string): Promise<Order | null> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return null
+
+  const rows = await db.select().from(orders).where(eq(orders.id, numId))
+  const row = rows[0]
+  if (!row) return null
+
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}
+
+export async function createOrder(data: CreateOrderInput): Promise<Order> {
+  const db = await getDb()
+  const now = new Date()
+  const result = await db
+    .insert(orders)
+    .values({
+      orderNo: generateOrderNo(),
+      customerName: data.customerName,
+      customerEmail: data.customerEmail,
+      productName: data.productName,
+      amount: data.amount,
+      status: 'pending',
+      createdAt: now,
+      updatedAt: now,
+    })
+    .returning()
+
+  const row = result[0]
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}
+
+export async function updateOrder(id: string, data: UpdateOrderInput): Promise<Order | null> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return null
+
+  const updateData: Partial<OrderTable> = {
+    updatedAt: new Date(),
+  }
+  if (data.status !== undefined && data.status !== null) {
+    updateData.status = data.status
+  }
+
+  const result = await db.update(orders).set(updateData).where(eq(orders.id, numId)).returning()
+
+  if (result.length === 0) return null
+  const row = result[0]
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}
+
+export async function deleteOrder(id: string): Promise<{ message: string }> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return { message: '订单不存在' }
+
+  const result = await db.delete(orders).where(eq(orders.id, numId)).returning()
+  if (result.length === 0) return { message: '订单不存在' }
+  return { message: '订单已删除' }
+}
+
+export async function processOrder(id: string): Promise<Order | null> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return null
+
+  const rows = await db.select().from(orders).where(eq(orders.id, numId))
+  const order = rows[0]
+  if (!order || order.status !== 'pending') return null
+
+  const result = await db
+    .update(orders)
+    .set({ status: 'processing', updatedAt: new Date() })
+    .where(eq(orders.id, numId))
+    .returning()
+
+  const row = result[0]
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}
+
+export async function cancelOrder(id: string): Promise<Order | null> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return null
+
+  const rows = await db.select().from(orders).where(eq(orders.id, numId))
+  const order = rows[0]
+  if (!order || (order.status !== 'pending' && order.status !== 'processing')) return null
+
+  const result = await db
+    .update(orders)
+    .set({ status: 'cancelled', updatedAt: new Date() })
+    .where(eq(orders.id, numId))
+    .returning()
+
+  const row = result[0]
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}
+
+export async function completeOrder(id: string): Promise<Order | null> {
+  const db = await getDb()
+  const numId = parseModuleId('order', id)
+  if (numId === -1) return null
+
+  const rows = await db.select().from(orders).where(eq(orders.id, numId))
+  const order = rows[0]
+  if (!order || order.status !== 'processing') return null
+
+  const result = await db
+    .update(orders)
+    .set({ status: 'completed', updatedAt: new Date() })
+    .where(eq(orders.id, numId))
+    .returning()
+
+  const row = result[0]
+  return {
+    id: `order-${row.id}`,
+    orderNo: row.orderNo,
+    customerName: row.customerName,
+    customerEmail: row.customerEmail,
+    productName: row.productName,
+    amount: row.amount,
+    status: row.status,
+    createdAt: toISOString(row.createdAt),
+    updatedAt: toISOString(row.updatedAt),
+  }
+}

package/template/src/server/module-permission/__tests__/permission-middleware.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import { permissionService } from '../services/permission-service-impl'
+import { roleService } from '../services/role-service'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+
+describe('Permission Middleware Integration', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  describe('hasPermission', () => {
+    it('should return true when customer service user has order:view permission', async () => {
+      const hasPermission = await permissionService.hasPermission(
+        'test-customer-service-2',
+        'order:view',
+        'customer_service'
+      )
+      expect(hasPermission).toBe(true)
+    })
+
+    it('should return false when customer service user does not have user:delete permission', async () => {
+      const hasPermission = await permissionService.hasPermission(
+        'test-customer-service-2',
+        'user:delete',
+        'customer_service'
+      )
+      expect(hasPermission).toBe(false)
+    })
+
+    it('should return true when customer service user has user:view permission', async () => {
+      const hasPermission = await permissionService.hasPermission(
+        'test-customer-service-2',
+        'user:view',
+        'customer_service'
+      )
+      expect(hasPermission).toBe(true)
+    })
+
+    it('should return true for super admin with any permission', async () => {
+      const hasPermission = await permissionService.hasPermission(
+        'test-super-admin-1',
+        'user:delete',
+        'super_admin'
+      )
+      expect(hasPermission).toBe(true)
+    })
+
+    it('should return false for non-existent user', async () => {
+      const hasPermission = await permissionService.hasPermission('non-existent-user', 'user:view')
+      expect(hasPermission).toBe(false)
+    })
+  })
+
+  describe('getUserRoles', () => {
+    it('should return empty array for test user (no user_roles data)', async () => {
+      const roles = await roleService.getUserRoles('test-customer-service-2')
+      expect(roles).toEqual([])
+    })
+
+    it('should return empty array for non-existent user', async () => {
+      const roles = await roleService.getUserRoles('non-existent-user')
+      expect(roles).toEqual([])
+    })
+  })
+
+  describe('getByCode', () => {
+    it('should return customer_service role by code', async () => {
+      const role = await roleService.getByCode('customer_service')
+      expect(role).toBeDefined()
+      expect(role?.code).toBe('customer_service')
+      expect(role?.name).toBe('客服人员')
+    })
+
+    it('should return super_admin role by code', async () => {
+      const role = await roleService.getByCode('super_admin')
+      expect(role).toBeDefined()
+      expect(role?.code).toBe('super_admin')
+      expect(role?.name).toBe('超级管理员')
+    })
+
+    it('should return undefined for non-existent role code', async () => {
+      const role = await roleService.getByCode('non_existent_role')
+      expect(role).toBeUndefined()
+    })
+  })
+})